add new service to view source

java/org/owasp/webgoat/LessonSource.java

@@ -1,4 +1,3 @@
-
 package org.owasp.webgoat;
 
 import java.io.IOException;
@@ -10,39 +9,40 @@ import org.owasp.webgoat.lessons.AbstractLesson;
 import org.owasp.webgoat.session.Course;
 import org.owasp.webgoat.session.WebSession;
 
-
+/**
-/***************************************************************************************************
+ * *************************************************************************************************
  *
  *
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * This file is part of WebGoat, an Open Web Application Security Project
- * please see http://www.owasp.org/
+ * utility. For details, please see http://www.owasp.org/
  *
  * Copyright (c) 2002 - 2007 Bruce Mayhew
  *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * This program is free software; you can redistribute it and/or modify it under
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * the terms of the GNU General Public License as published by the Free Software
- * License, or (at your option) any later version.
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
  *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * This program is distributed in the hope that it will be useful, but WITHOUT
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * General Public License for more details.
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
  *
- * You should have received a copy of the GNU General Public License along with this program; if
+ * You should have received a copy of the GNU General Public License along with
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * 02111-1307, USA.
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
  *
  * Getting Source ==============
  *
- * Source for this application is maintained at code.google.com, a repository for free software
+ * Source for this application is maintained at code.google.com, a repository
- * projects.
+ * for free software projects.
  *
  * For details, please see http://code.google.com/p/webgoat/
  *
  * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
  * @created October 28, 2003
  */
-public class LessonSource extends HammerHead
+public class LessonSource extends HammerHead {
-{
 
     /**
      *
@@ -59,21 +59,15 @@ public class LessonSource extends HammerHead
     /**
      * Description of the Method
      *
-	 * @param request
+     * @param request Description of the Parameter
-	 *            Description of the Parameter
+     * @param response Description of the Parameter
-	 * @param response
+     * @exception IOException Description of the Exception
-	 *            Description of the Parameter
+     * @exception ServletException Description of the Exception
-	 * @exception IOException
-	 *                Description of the Exception
-	 * @exception ServletException
-	 *                Description of the Exception
      */
-	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
-	{
         String source = null;
 
-		try
+        try {
-		{
 			// System.out.println( "Entering doPost: " );
             // System.out.println( " - request " + request);
             // System.out.println( " - principle: " + request.getUserPrincipal()
@@ -85,8 +79,7 @@ public class LessonSource extends HammerHead
 
             boolean showSolution = session.getParser().getBooleanParameter("solution", false);
             boolean showSource = session.getParser().getBooleanParameter("source", false);
-			if (showSolution)
+            if (showSolution) {
-			{
 
                 // Get the Java solution of the lesson.
                 source = getSolution(session);
@@ -96,9 +89,7 @@ public class LessonSource extends HammerHead
                 AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE);
                 lesson.getLessonTracker(session).setViewedSolution(true);
 
-			}
+            } else if (showSource) {
-			else if (showSource)
-			{
 
                 // Get the Java source of the lesson. FIXME: Not needed
                 source = getSource(session);
@@ -108,17 +99,13 @@ public class LessonSource extends HammerHead
                 AbstractLesson lesson = course.getLesson(session, scr, AbstractLesson.USER_ROLE);
                 lesson.getLessonTracker(session).setViewedSource(true);
             }
-		} catch (Throwable t)
+        } catch (Throwable t) {
-		{
             t.printStackTrace();
             log("ERROR: " + t);
-		} finally
+        } finally {
-		{
+            try {
-			try
-			{
                 this.writeSource(source, response);
-			} catch (Throwable thr)
+            } catch (Throwable thr) {
-			{
                 thr.printStackTrace();
                 log(request, "Could not write error screen: " + thr.getMessage());
             }
@@ -130,73 +117,65 @@ public class LessonSource extends HammerHead
     /**
      * Description of the Method
      *
-	 * @param s
+     * @param s Description of the Parameter
-	 *            Description of the Parameter
      * @return Description of the Return Value
      */
-	protected String getSource(WebSession s)
+    protected String getSource(WebSession s) {
-	{
 
         String source = null;
         int scr = s.getCurrentScreen();
         Course course = s.getCourse();
 
-		if (s.isUser() || s.isChallenge())
+        if (s.isUser() || s.isChallenge()) {
-		{
 
             AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
 
-			if (lesson != null)
+            if (lesson != null) {
-			{
                 source = lesson.getSource(s);
             }
         }
-		if (source == null) { return "Source code is not available. Contact "
+        if (source == null) {
-				+ s.getWebgoatContext().getFeedbackAddressHTML(); }
+            return "Source code is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
         return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
                 "Code Section Deliberately Omitted"));
     }
 
-	protected String getSolution(WebSession s)
+    protected String getSolution(WebSession s) {
-	{
 
         String source = null;
         int scr = s.getCurrentScreen();
         Course course = s.getCourse();
 
-		if (s.isUser() || s.isChallenge())
+        if (s.isUser() || s.isChallenge()) {
-		{
 
             AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
 
-			if (lesson != null)
+            if (lesson != null) {
-			{
                 source = lesson.getSolution(s);
             }
         }
-		if (source == null) { return "Solution  is not available. Contact "
+        if (source == null) {
-				+ s.getWebgoatContext().getFeedbackAddressHTML(); }
+            return "Solution  is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
         return (source);
     }
 
     /**
      * Description of the Method
      *
-	 * @param s
+     * @param s Description of the Parameter
-	 *            Description of the Parameter
+     * @param response Description of the Parameter
-	 * @param response
+     * @exception IOException Description of the Exception
-	 *            Description of the Parameter
-	 * @exception IOException
-	 *                Description of the Exception
      */
-	protected void writeSource(String s, HttpServletResponse response) throws IOException
+    protected void writeSource(String s, HttpServletResponse response) throws IOException {
-	{
         response.setContentType("text/html");
 
         PrintWriter out = response.getWriter();
 
-		if (s == null)
+        if (s == null) {
-		{
             s = new String();
         }
 

java/org/owasp/webgoat/lessons/AbstractLesson.java

@@ -1,6 +1,7 @@
 package org.owasp.webgoat.lessons;
 
 import java.io.BufferedReader;
+import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.InputStreamReader;
 import java.io.StringReader;
@@ -316,7 +317,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
 
     // @TODO we need to restrict access at the service layer
     // rather than passing session object around
-    public List<String> getHintsPublic(WebSession s){
+    public List<String> getHintsPublic(WebSession s) {
         List<String> hints = getHints(s);
         return hints;
     }
@@ -491,6 +492,25 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
         return source;
     }
 
+    public String getRawSource(WebSession s) {
+        String src;
+
+        try {
+            // System.out.println("Loading source file: " +
+            // getSourceFileName());
+            src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getSourceFileName()))), true);
+
+        } catch (FileNotFoundException e) {
+            s.setMessage("Could not find source file");
+            src = ("Could not find the source file or source file does not exist.<br/>"
+                    + "Send this message to: <a href=\"mailto:" + s.getWebgoatContext().getFeedbackAddress()
+                    + "?subject=Source " + getSourceFileName() + " not found. Lesson: "
+                    + s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext().getFeedbackAddress() + "</a>");
+        }
+
+        return src;
+    }
+
     public String getSolution(WebSession s) {
         String src = null;
 

java/org/owasp/webgoat/service/CookieService.java

@@ -30,12 +30,9 @@
  */
 package org.owasp.webgoat.service;
 
-import java.util.ArrayList;
 import java.util.List;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpSession;
-import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.model.Hint;
 import org.owasp.webgoat.session.WebSession;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;

java/org/owasp/webgoat/service/SourceService.java

@@ -0,0 +1,91 @@
+/**
+ * *************************************************************************************************
+ *
+ *
+ * This file is part of WebGoat, an Open Web Application Security Project
+ * utility. For details, please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any later
+ * version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at code.google.com, a repository
+ * for free software projects.
+ *
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+package org.owasp.webgoat.service;
+
+import javax.servlet.http.HttpSession;
+import static org.owasp.webgoat.LessonSource.END_SOURCE_SKIP;
+import static org.owasp.webgoat.LessonSource.START_SOURCE_SKIP;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+/**
+ *
+ * @author rlawson
+ */
+@Controller
+public class SourceService extends BaseService {
+
+    /**
+     * Returns source for current attack
+     *
+     * @param session
+     * @return
+     */
+    @RequestMapping(value = "/source.mvc", produces = "application/json")
+    public @ResponseBody
+    String showSource(HttpSession session) {
+        WebSession ws = getWebSesion(session);
+        String source = getSource(ws);
+        return source;
+    }
+
+    /**
+     * Description of the Method
+     *
+     * @param s Description of the Parameter
+     * @return Description of the Return Value
+     */
+    protected String getSource(WebSession s) {
+
+        String source = null;
+        int scr = s.getCurrentScreen();
+        Course course = s.getCourse();
+
+        if (s.isUser() || s.isChallenge()) {
+
+            AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
+
+            if (lesson != null) {
+                source = lesson.getRawSource(s);
+            }
+        }
+        if (source == null) {
+            return "Source code is not available. Contact "
+                    + s.getWebgoatContext().getFeedbackAddressHTML();
+        }
+        return (source.replaceAll("(?s)" + START_SOURCE_SKIP + ".*" + END_SOURCE_SKIP,
+                "Code Section Deliberately Omitted"));
+    }
+}